I've been able to work with a user at this particular site. I had them run kix32.exe script.kix -d and step through as the script runs. It process most of the If InGroup calls successfully, but for others, it looks as though it is checking, but then decides the user is not part of the group? (when they are). At the moment, the script processes successfully on Win 8 PC's, but not on Win 7's. Some mappings are mapped all the time at logon, others never map. Does Win 7 need anything on the DC side to read group membership correctly each time?